Access Based Enumeration on Windows 7

Access Based Enumeration (ABE) is a well-hidden feature even in Windows Server, where it can be configured per share, but only in the Share and Storage Management MMC and not when right-clicking a folder in Explorer. Thanks to the shared code base ABE is available in Windows 7, too, although hidden even better. Let’s find out how to enable it anyway.

First we need a share to play around with. I set up a shared folder with three subfolders. When I access it over then network, everything looks as expected:

Next we remove permissions on one of the subfolders so that users do not have read access any more. We do that with SetACL Studio, of course!

Then we download the free tool ShrFlgs and issue the following command in an elevated prompt:

D:\>ShrFlgs.exe \\localhost\test /abe true /forreal
 
ShrFlgs V01.00.01cpp Joe Richards (joe@joeware.net) February 2005
 
Share: test
  Path       : R:\
  Remark     :
  Max Use    : Unlimited
  Current Use: 1
  SDDL       :
  Flags
       Manual Client Side Caching
       Exclusive Opens Allowed
       Force Delete NOT Allowed
       Namespace Caching NOT Allowed
       Access Based Enumeration
 
The command completed successfully.

Finally we check again in Explorer, and voilà, the directory sub2 is gone:

, , , , ,

13 Responses to Access Based Enumeration on Windows 7

  1. wormer February 5, 2012 at 10:29 #

    JESUS!!! Thank you soooo much for this post!!! Trying to solve this problem on win 7 for several days already with no success. I **cking knew this has a solution, because windows HIDES subfolders under users! It DOES that……..

    I’m sorry for too emotional reply) Thank you very much! This was *really* helpful for me!

  2. xpclient June 23, 2012 at 15:39 #

    Is there a GUI way to do this on client? On Server there is the MMC.

  3. xpclient June 24, 2012 at 20:11 #

    I removed the OS check from the Access Based Enumeration GUI MSI file for Server 2003 and it works nicely on Windows 7/Vista/Server 2008/R2 as well.

    • PeterM July 11, 2013 at 13:20 #

      How?

  4. Andrea January 10, 2013 at 07:31 #

    FTM, I used shrflgs.exe on Windows Server 2012 Shares and it worked.

  5. Ian Wijaya March 9, 2013 at 05:52 #

    Thanks !!!

  6. Raymond Nolten April 5, 2013 at 09:30 #

    Hi,

    How do I create a hidden directory but visible for specified users/groups?
    Is that possible with this tool without using the $ sign on share level?

    regards,

    Ray

  7. Tom December 29, 2013 at 03:36 #

    does not work with windows 7 64bit. Wondering if another version/release of ShrFlgs support it.

    • Phil May 4, 2014 at 12:09 #

      Strange, worked for me on Windows 7 64bit, ShrFlgs V01.00.01!

      And thank you for the guide, pretty OP

  8. Marnus January 5, 2015 at 11:40 #

    Ran as instructed and it worked on Windows 7 Ultimate 64-bit system.

    So now my users who do have access to certain folders under the share can’t view them which is what I wanted.

    Problem – Even if I grant a user read/write access, the user is unable to create files in the sub directory of the share. Also, when I try assign rights by right clicking ——> Share with ——> Specific people, once I select the rights and click share I get prompted by Windows that “You cannot share this folder”?

    Any ideas on how to get around this?

  9. Marnus January 5, 2015 at 12:59 #

    Okay so I got this figured out.

    The problem was that when I created the network share, I gave “Everyone” access but limited the access to read-only. I had to change that to give “Everyone” full control to the share only. From there the actual NTFS permissions I granted to each individual folder controlled the level of access I required.

    My users can now perform work on their individual folders while not seeing any folders on the share to which they do not have access to.

    Many thanks for this!

  10. KA April 18, 2015 at 11:28 #

    I could run shrflgs successfully on Windows 7 64bit. It stopped working when it reached my “Music” directory. Is it possible that many subfolders mess it up (e.g. maybe there is a counter up to 1000 subfolders, let’s say, and if you have 1,001 it hits an exception?).

    Thanks!

  11. Galinette October 8, 2016 at 08:24 #

    Thanks a lot! This worked on Win7 SP1 64-bit. It prevents Offline File Sync showing an error message when trying to sync the $RECYCLE.BIN folder, since this folder is not visible anymore on the clients.

Leave a Reply